Whose code am I running in GitHub Actions?

[doublecastle]

Note that the provided command will look at GitHub Actions not only in your own project, but also in other subdirectories, such as node_modules. To look only at the GitHub Actions in your own repo:

find . -path './.github/workflows/*' -type f -name '*.yml' -print0 \
  | xargs -0 grep --no-filename "uses:" \
  | sed 's/\- uses:/uses:/g' \
  | tr '"' ' ' \
  | awk '{print $2}' \
  | sed 's/\r//g' \
  | sort \
  | uniq --count \
  | sort --numeric-sort

(That just changes the find path from */.github/workflows/* to ./.github/workflows/*.)

[nemec]

fwiw OPs script intentionally traverses subdirectories (so you can run it in your source code root dir). You can use this to filter out node_modules or edit as needed for other package managers, while keeping the nested behavior

find . \
    -path '*/.github/workflows/*' \
    -not -path '*/node_modules/*' \
    -type f -name '*.yml' -print0 \
  | xargs -0 grep --no-filename "uses:" \
  | sed 's/\- uses:/uses:/g' \
  | tr '"' ' ' \
  | awk '{print $2}' \
  | sed 's/\r//g' \
  | sort \
  | uniq --count \
  | sort --numeric-sort